From 950e2a837c344fa2d656cb98f471eba9a15ec4a4 Mon Sep 17 00:00:00 2001 From: Mukund Sarma <23266464+dnukumamras@users.noreply.github.com> Date: Thu, 20 Aug 2026 08:22:27 -0700 Subject: [PATCH] fix: strip comments from inline style values in linear time (#18553) `to_style()` strips CSS comments from an inline `style` value with `/\s*\/\*.*?\*\/\s*/g`. The leading `\s*` makes the match retry from every position, so a long run of whitespace backtracks in O(n^2). When a dynamic `style={value}` sits on an element that also has a `style:` directive, that regex runs on `value`, so a large whitespace string can stall rendering (server) or the main thread (client). ### Fix Drop the surrounding `\s*` and match only the comment: `/\/\*.*?\*\//g` to prevent quadratic regex. The surrounding whitespace was already removed by the `.trim()` --------- Co-authored-by: Claude Opus 4.8 Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com> --- .changeset/strip-style-comments.md | 5 +++++ packages/svelte/src/internal/shared/attributes.js | 3 ++- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 .changeset/strip-style-comments.md diff --git a/.changeset/strip-style-comments.md b/.changeset/strip-style-comments.md new file mode 100644 index 0000000000..6a27e431df --- /dev/null +++ b/.changeset/strip-style-comments.md @@ -0,0 +1,5 @@ +--- +'svelte': patch +--- + +fix: strip comments from inline `style` values in linear time diff --git a/packages/svelte/src/internal/shared/attributes.js b/packages/svelte/src/internal/shared/attributes.js index 487a40baf3..bb1abf22c1 100644 --- a/packages/svelte/src/internal/shared/attributes.js +++ b/packages/svelte/src/internal/shared/attributes.js @@ -142,8 +142,9 @@ export function to_style(value, styles) { } if (value) { + // strip comments; surrounding whitespace is handled by the trims below (which is much faster than doing it through regex) value = String(value) - .replaceAll(/\s*\/\*.*?\*\/\s*/g, '') + .replaceAll(/\/\*.*?\*\//g, '') .trim(); /** @type {boolean | '"' | "'"} */